@kensio/yulin 1.21.3 → 1.21.5

package/dist/service/s3/bucket/sim-s3-public-read.fixture.js

@@ -11,6 +11,12 @@
  * issues exactly the two commands a real deployment issues rather than reaching
  * around them, so a test using it exercises the same path a user's own setup
  * would.
+ *
+ * The policy grants listing alongside the read. Real S3 admits that a key is
+ * missing only to a reader holding `s3:ListBucket`, and answers 403 to a
+ * reader holding the Object read alone. A site with its own error document, a
+ * folder redirect or a custom 404 error response grants both permissions for
+ * that reason.
  */
 export async function grantPublicObjectRead(simS3, bucketName) {
     await simS3.putPublicAccessBlock({
@@ -27,12 +33,20 @@ export async function grantPublicObjectRead(simS3, bucketName) {
             Bucket: bucketName,
             Policy: JSON.stringify({
                 Version: "2012-10-17",
-                Statement: {
-                    Effect: "Allow",
-                    Principal: "*",
-                    Action: "s3:GetObject",
-                    Resource: `arn:aws:s3:::${bucketName}/*`,
-                },
+                Statement: [
+                    {
+                        Effect: "Allow",
+                        Principal: "*",
+                        Action: "s3:GetObject",
+                        Resource: `arn:aws:s3:::${bucketName}/*`,
+                    },
+                    {
+                        Effect: "Allow",
+                        Principal: "*",
+                        Action: "s3:ListBucket",
+                        Resource: `arn:aws:s3:::${bucketName}`,
+                    },
+                ],
             }),
         },
     });

package/dist/service/s3/bucket/tagging/sim-s3-taggable-object.d.ts

@@ -0,0 +1,58 @@
+import type { SimS3Object } from "../../object/s3-object.js";
+import type { SimS3ObjectTagSet } from "../../object/s3-object-tags.js";
+import type { SimS3BucketStorage } from "../../storage/s3-bucket-storage.js";
+import type { SimS3BucketVersions } from "../versioning/sim-s3-bucket-versions.js";
+/**
+ * What a tagging request names, as a Bucket can answer it.
+ *
+ * `stored` is what a plain read of the key answers with, which a request
+ * naming a version has no need of and passes as nothing.
+ */
+interface SimS3TaggingTarget {
+    readonly storage: SimS3BucketStorage;
+    readonly versions: SimS3BucketVersions;
+    readonly key: string;
+    readonly versionId: string | undefined;
+    readonly stored: SimS3Object | undefined;
+}
+/**
+ * The Object a tagging request names, ready to be read or retagged.
+ *
+ * A tag set lives on the Object, and an Object lives in two places at once on a
+ * Bucket that keeps versions: in storage under its key, and in the version
+ * history. Retagging the current Object has to reach both, or a read of the key
+ * and a read of the version would disagree about the tags. Retagging an older
+ * version reaches the history alone, since storage holds nothing of it.
+ */
+export declare class SimS3TaggableObject {
+    private readonly object;
+    private readonly storage;
+    private readonly version;
+    private readonly current;
+    private constructor();
+    /**
+     * Find the Object a tagging request names, or refuse the request the way
+     * real S3 refuses it.
+     *
+     * A key holding nothing is `NoSuchKey`, an id no version of it was given is
+     * `NoSuchVersion`, and a delete marker holds no Object to tag.
+     */
+    static named(target: SimS3TaggingTarget): SimS3TaggableObject;
+    /**
+     * The tags this Object carries.
+     */
+    get tagSet(): SimS3ObjectTagSet;
+    /**
+     * The version this Object is, on a Bucket keeping versions, which a tagging
+     * response reports back.
+     */
+    get versionId(): string | undefined;
+    /**
+     * Put a tag set on this Object, answering the Object as it now stands.
+     *
+     * The version is retagged first so that the Object written back to storage is
+     * the one the history holds, rather than an equal Object built alongside it.
+     */
+    retag(tags: SimS3ObjectTagSet): Promise<SimS3Object>;
+}
+export {};

package/dist/service/s3/bucket/tagging/sim-s3-taggable-object.js

@@ -0,0 +1,73 @@
+import { SimS3MethodNotAllowed, SimS3NoSuchKey, SimS3NoSuchVersion, } from "../../error/sim-s3.error.js";
+/**
+ * The Object a tagging request names, ready to be read or retagged.
+ *
+ * A tag set lives on the Object, and an Object lives in two places at once on a
+ * Bucket that keeps versions: in storage under its key, and in the version
+ * history. Retagging the current Object has to reach both, or a read of the key
+ * and a read of the version would disagree about the tags. Retagging an older
+ * version reaches the history alone, since storage holds nothing of it.
+ */
+export class SimS3TaggableObject {
+    object;
+    storage;
+    version;
+    current;
+    constructor(object, storage, version, current) {
+        this.object = object;
+        this.storage = storage;
+        this.version = version;
+        this.current = current;
+    }
+    /**
+     * Find the Object a tagging request names, or refuse the request the way
+     * real S3 refuses it.
+     *
+     * A key holding nothing is `NoSuchKey`, an id no version of it was given is
+     * `NoSuchVersion`, and a delete marker holds no Object to tag.
+     */
+    static named(target) {
+        const { storage, versions, key, versionId } = target;
+        if (versionId === undefined) {
+            if (target.stored === undefined) {
+                throw new SimS3NoSuchKey(`No S3 Object named ${key}`);
+            }
+            return new SimS3TaggableObject(target.stored, storage, versions.current(key), true);
+        }
+        const version = versions.find(key, versionId);
+        if (version === undefined) {
+            throw new SimS3NoSuchVersion(`No version ${versionId} of S3 Object ${key}`);
+        }
+        if (version.isDeleteMarker) {
+            throw new SimS3MethodNotAllowed(`Version ${versionId} of S3 Object ${key} is a delete marker`);
+        }
+        return new SimS3TaggableObject(version.object, storage, version, version === versions.current(key));
+    }
+    /**
+     * The tags this Object carries.
+     */
+    get tagSet() {
+        return this.object.tags;
+    }
+    /**
+     * The version this Object is, on a Bucket keeping versions, which a tagging
+     * response reports back.
+     */
+    get versionId() {
+        return this.version?.versionId;
+    }
+    /**
+     * Put a tag set on this Object, answering the Object as it now stands.
+     *
+     * The version is retagged first so that the Object written back to storage is
+     * the one the history holds, rather than an equal Object built alongside it.
+     */
+    async retag(tags) {
+        this.version?.tagged(tags);
+        const tagged = this.version?.object ?? this.object.withTags(tags);
+        if (this.current) {
+            await this.storage.putObject(tagged);
+        }
+        return tagged;
+    }
+}

package/dist/service/s3/bucket/versioning/sim-s3-object-version.d.ts

@@ -1,5 +1,7 @@
 import { SimS3ObjectLock } from "../lock/sim-s3-object-lock.js";
 import type { SimS3Object } from "../../object/s3-object.js";
+import type { SimS3ObjectTagSet } from "../../object/s3-object-tags.js";
+import type { SimS3StorageClass } from "../../object/s3-storage-class.js";
 interface SimS3ObjectVersionProperties {
     readonly versionId: string;
     readonly key: string;
@@ -32,7 +34,7 @@ export declare class SimS3ObjectVersion {
     readonly lock: SimS3ObjectLock;
     private displaced;
     private readonly createdAt;
-    private readonly stored;
+    private stored;
     constructor(properties: SimS3ObjectVersionProperties);
     /**
      * The version an Object in a Bucket that keeps none reads back under.
@@ -41,6 +43,22 @@ export declare class SimS3ObjectVersion {
      * and answers ListObjectVersions for one as a history a single entry deep.
      */
     static nullVersionOf(object: SimS3Object): SimS3ObjectVersion;
+    /**
+     * Move the Object this version holds into another storage class.
+     *
+     * A lifecycle rule transitions a noncurrent version where it lies, so the
+     * class is recorded on the version rather than derived on each read of it. A
+     * delete marker holds no Object and transitions nowhere.
+     */
+    transitionTo(storageClass: SimS3StorageClass): void;
+    /**
+     * Replace the tags on the Object this version holds.
+     *
+     * Tags belong to the version they were put on, so tagging the current
+     * version leaves an older one carrying whatever it was written with. A
+     * delete marker holds no Object and carries no tags.
+     */
+    tagged(tags: SimS3ObjectTagSet): void;
     /**
      * Whether this version records a deletion instead of holding bytes.
      */

package/dist/service/s3/bucket/versioning/sim-s3-object-version.js

@@ -44,6 +44,26 @@ export class SimS3ObjectVersion {
             object,
         });
     }
+    /**
+     * Move the Object this version holds into another storage class.
+     *
+     * A lifecycle rule transitions a noncurrent version where it lies, so the
+     * class is recorded on the version rather than derived on each read of it. A
+     * delete marker holds no Object and transitions nowhere.
+     */
+    transitionTo(storageClass) {
+        this.stored = this.stored?.withStorageClass(storageClass);
+    }
+    /**
+     * Replace the tags on the Object this version holds.
+     *
+     * Tags belong to the version they were put on, so tagging the current
+     * version leaves an older one carrying whatever it was written with. A
+     * delete marker holds no Object and carries no tags.
+     */
+    tagged(tags) {
+        this.stored = this.stored?.withTags(tags);
+    }
     /**
      * Whether this version records a deletion instead of holding bytes.
      */

package/dist/service/s3/cfn/bucket/encryption/sim-cfn-s3-bucket-encryption.d.ts

@@ -0,0 +1,21 @@
+import type { SimCfnTemplateValueRecord } from "../../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimS3ServerSideEncryptionConfiguration } from "../../../bucket/encryption/sim-s3-bucket-encryption.js";
+/**
+ * Reads the `BucketEncryption` property of an AWS::S3::Bucket Resource into a
+ * PutBucketEncryption request.
+ *
+ * CloudFormation and the API disagree about one name. A template states
+ * `ServerSideEncryptionByDefault` inside each rule where the request states
+ * `ApplyServerSideEncryptionByDefault`, so that one is translated here and
+ * everything else is handed on as it was declared.
+ */
+export declare class SimCfnS3BucketEncryption {
+    private readonly properties;
+    private readonly shape;
+    constructor(logicalId: string, properties: SimCfnTemplateValueRecord);
+    /**
+     * The configuration to apply, or nothing when the Resource declares none.
+     */
+    read(): SimS3ServerSideEncryptionConfiguration | undefined;
+    private readRule;
+}

package/dist/service/s3/cfn/bucket/encryption/sim-cfn-s3-bucket-encryption.js

@@ -0,0 +1,44 @@
+import { SimCfnValueShape } from "../../../../cloudformation/template/value/sim-cfn-value-shape.js";
+import { s3BucketResourceError } from "../error/sim-cfn-s3-bucket-error.js";
+/**
+ * Reads the `BucketEncryption` property of an AWS::S3::Bucket Resource into a
+ * PutBucketEncryption request.
+ *
+ * CloudFormation and the API disagree about one name. A template states
+ * `ServerSideEncryptionByDefault` inside each rule where the request states
+ * `ApplyServerSideEncryptionByDefault`, so that one is translated here and
+ * everything else is handed on as it was declared.
+ */
+export class SimCfnS3BucketEncryption {
+    properties;
+    shape;
+    constructor(logicalId, properties) {
+        this.properties = properties;
+        this.shape = new SimCfnValueShape((reason) => s3BucketResourceError(logicalId, reason));
+    }
+    /**
+     * The configuration to apply, or nothing when the Resource declares none.
+     */
+    read() {
+        const declared = this.properties["BucketEncryption"];
+        if (declared === undefined) {
+            return undefined;
+        }
+        const encryption = this.shape.record(declared, "BucketEncryption");
+        const rules = this.shape.list(encryption["ServerSideEncryptionConfiguration"] ?? [], "BucketEncryption ServerSideEncryptionConfiguration");
+        return { Rules: rules.map((rule, index) => this.readRule(rule, index)) };
+    }
+    readRule(value, index) {
+        const named = `BucketEncryption rule ${index}`;
+        const rule = this.shape.record(value, named);
+        const byDefault = rule["ServerSideEncryptionByDefault"];
+        return {
+            ...(byDefault !== undefined && {
+                ApplyServerSideEncryptionByDefault: this.shape.record(byDefault, `${named} ServerSideEncryptionByDefault`),
+            }),
+            ...(rule["BucketKeyEnabled"] !== undefined && {
+                BucketKeyEnabled: rule["BucketKeyEnabled"] === true,
+            }),
+        };
+    }
+}

package/dist/service/s3/cfn/bucket/lifecycle/sim-cfn-s3-bucket-lifecycle-configuration.js

@@ -1,6 +1,7 @@
 import { SimCfnValueShape } from "../../../../cloudformation/template/value/sim-cfn-value-shape.js";
 import { s3BucketResourceError } from "../error/sim-cfn-s3-bucket-error.js";
 import { simCfnS3CarriedRuleFields, simCfnS3RuleExpiration, simCfnS3RuleNoncurrentExpiration, simCfnS3StatedFields, } from "./sim-cfn-s3-bucket-lifecycle-fields.js";
+import { readSimCfnS3LifecycleFilter } from "./sim-cfn-s3-bucket-lifecycle-filter.js";
 import { readSimCfnS3LifecycleTransitions } from "./sim-cfn-s3-bucket-lifecycle-transitions.js";
 /**
  * Reads the `LifecycleConfiguration` property of an AWS::S3::Bucket Resource
@@ -43,6 +44,11 @@ export class SimCfnS3BucketLifecycleConfiguration {
             ...simCfnS3CarriedRuleFields(rule),
             ...simCfnS3StatedFields({
                 ID: rule["Id"],
+                Filter: readSimCfnS3LifecycleFilter({
+                    shape: this.shape,
+                    rule,
+                    path,
+                }),
                 Expiration: simCfnS3RuleExpiration(rule),
                 NoncurrentVersionExpiration: simCfnS3RuleNoncurrentExpiration(rule),
                 Transitions: readSimCfnS3LifecycleTransitions({

package/dist/service/s3/cfn/bucket/lifecycle/sim-cfn-s3-bucket-lifecycle-fields.d.ts

@@ -6,10 +6,11 @@ import type { SimCfnTemplateValue, SimCfnTemplateValueRecord } from "../../../..
  * timing after it, where the request nests both. It carries the noncurrent
  * expiry both ways, as the nested object the request takes and as the older
  * `NoncurrentVersionExpirationInDays` beside it, which is what CDK's
- * `noncurrentVersionExpiration` synthesises. Everything absent from here,
- * `Status`, `Prefix`, `AbortIncompleteMultipartUpload`, `TagFilters` and the
- * object size bounds among them, is spelled the same way in both and goes
- * through untouched.
+ * `noncurrentVersionExpiration` synthesises. It also puts the tags a rule
+ * filters on beside the rule's `Prefix`, where the request holds both inside a
+ * `Filter`. Everything absent from here, `Status`,
+ * `AbortIncompleteMultipartUpload` and the object size bounds among them, is
+ * spelled the same way in both and goes through untouched.
  */
 export declare const simCfnS3TranslatedLifecycleFields: ReadonlySet<string>;
 /**

package/dist/service/s3/cfn/bucket/lifecycle/sim-cfn-s3-bucket-lifecycle-fields.js

@@ -5,10 +5,11 @@
  * timing after it, where the request nests both. It carries the noncurrent
  * expiry both ways, as the nested object the request takes and as the older
  * `NoncurrentVersionExpirationInDays` beside it, which is what CDK's
- * `noncurrentVersionExpiration` synthesises. Everything absent from here,
- * `Status`, `Prefix`, `AbortIncompleteMultipartUpload`, `TagFilters` and the
- * object size bounds among them, is spelled the same way in both and goes
- * through untouched.
+ * `noncurrentVersionExpiration` synthesises. It also puts the tags a rule
+ * filters on beside the rule's `Prefix`, where the request holds both inside a
+ * `Filter`. Everything absent from here, `Status`,
+ * `AbortIncompleteMultipartUpload` and the object size bounds among them, is
+ * spelled the same way in both and goes through untouched.
  */
 export const simCfnS3TranslatedLifecycleFields = new Set([
     "Id",
@@ -17,6 +18,7 @@ export const simCfnS3TranslatedLifecycleFields = new Set([
     "ExpiredObjectDeleteMarker",
     "NoncurrentVersionExpiration",
     "NoncurrentVersionExpirationInDays",
+    "TagFilters",
     "Transition",
     "Transitions",
 ]);
@@ -50,7 +52,12 @@ export function simCfnS3StatedFields(fields) {
  * acts on anyway.
  */
 export function simCfnS3CarriedRuleFields(rule) {
-    return Object.fromEntries(Object.entries(rule).filter(([name]) => !simCfnS3TranslatedLifecycleFields.has(name)));
+    // A rule filtering on tags carries its prefix inside the `Filter` built from
+    // them, and real S3 refuses a rule stating a `Prefix` alongside one.
+    const translated = rule["TagFilters"] === undefined
+        ? simCfnS3TranslatedLifecycleFields
+        : new Set([...simCfnS3TranslatedLifecycleFields, "Prefix"]);
+    return Object.fromEntries(Object.entries(rule).filter(([name]) => !translated.has(name)));
 }
 /**
  * The three flattened expiry fields, gathered under the one the request

package/dist/service/s3/cfn/bucket/lifecycle/sim-cfn-s3-bucket-lifecycle-filter.d.ts

@@ -0,0 +1,21 @@
+import type { SimCfnTemplateValue, SimCfnTemplateValueRecord } from "../../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimCfnValueShape } from "../../../../cloudformation/template/value/sim-cfn-value-shape.js";
+interface SimCfnS3LifecycleFilterProperties {
+    readonly shape: SimCfnValueShape;
+    readonly rule: SimCfnTemplateValueRecord;
+    readonly path: string;
+}
+/**
+ * The `Filter` a rule's `TagFilters` states.
+ *
+ * CloudFormation puts the tags a rule filters on beside its `Prefix`, where the
+ * request holds both inside a `Filter`, so a rule stating tags is read into the
+ * shape the request takes. One tag and no prefix becomes a bare `Tag`, and
+ * anything more an `And` holding the prefix and the tags together, which is
+ * what real S3 requires of a rule scoped by more than one condition.
+ *
+ * A rule stating no tags keeps its `Prefix` where CloudFormation put it, and
+ * gets no `Filter` at all.
+ */
+export declare function readSimCfnS3LifecycleFilter(properties: SimCfnS3LifecycleFilterProperties): SimCfnTemplateValue | undefined;
+export {};

package/dist/service/s3/cfn/bucket/lifecycle/sim-cfn-s3-bucket-lifecycle-filter.js

@@ -0,0 +1,30 @@
+/**
+ * The `Filter` a rule's `TagFilters` states.
+ *
+ * CloudFormation puts the tags a rule filters on beside its `Prefix`, where the
+ * request holds both inside a `Filter`, so a rule stating tags is read into the
+ * shape the request takes. One tag and no prefix becomes a bare `Tag`, and
+ * anything more an `And` holding the prefix and the tags together, which is
+ * what real S3 requires of a rule scoped by more than one condition.
+ *
+ * A rule stating no tags keeps its `Prefix` where CloudFormation put it, and
+ * gets no `Filter` at all.
+ */
+export function readSimCfnS3LifecycleFilter(properties) {
+    const { shape, rule, path } = properties;
+    const declared = rule["TagFilters"];
+    if (declared === undefined) {
+        return undefined;
+    }
+    const tags = shape
+        .list(declared, `${path} TagFilters`)
+        .map((tag, index) => shape.record(tag, `${path} TagFilters[${index}]`));
+    const prefix = rule["Prefix"];
+    const only = tags.length === 1 ? tags[0] : undefined;
+    if (prefix === undefined && only !== undefined) {
+        return { Tag: only };
+    }
+    return {
+        And: { ...(prefix !== undefined && { Prefix: prefix }), Tags: tags },
+    };
+}

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-configurator.js

@@ -43,6 +43,7 @@ export class SimCfnS3BucketConfigurator {
         await this.declared.applyVersioning();
         await this.declared.applyObjectLock();
         await this.declared.applyLifecycle();
+        await this.declared.applyEncryption();
         await this.configureNotifications();
     }
     /**

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-declared-configurations.d.ts

@@ -12,7 +12,7 @@ interface SimCfnS3BucketDeclaredConfigurationsProperties {
  * The AWS::S3::Bucket properties that are read straight off the Resource and
  * handed to a command.
  *
- * Five properties with one shape between them. Each is read from the Resource,
+ * Six properties with one shape between them. Each is read from the Resource,
  * left alone where the Resource omitted it, and otherwise applied through the
  * command an SDK caller would reach, so a template and an SDK caller are
  * validated identically. The event notification configuration is the one that
@@ -51,6 +51,19 @@ export declare class SimCfnS3BucketDeclaredConfigurations {
      * Apply the lifecycle rules the Resource declares.
      */
     applyLifecycle(): Promise<void>;
+    /**
+     * Apply the default encryption the Resource declares.
+     */
+    applyEncryption(): Promise<void>;
+    /**
+     * Apply one declared property, or leave the Bucket alone where the Resource
+     * omitted it.
+     *
+     * The one absence check for all six of them lives here. Each property is
+     * otherwise the same shape: read it off the Resource, and hand it to the
+     * command an SDK caller would reach.
+     */
+    private applyDeclared;
     /**
      * Read one declared property, or nothing where the Resource omitted it.
      *

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-declared-configurations.js

@@ -1,3 +1,4 @@
+import { SimCfnS3BucketEncryption } from "./encryption/sim-cfn-s3-bucket-encryption.js";
 import { SimCfnS3BucketLifecycleConfiguration } from "./lifecycle/sim-cfn-s3-bucket-lifecycle-configuration.js";
 import { SimCfnS3BucketObjectLockConfiguration } from "./lock/sim-cfn-s3-bucket-object-lock-configuration.js";
 import { SimCfnS3BucketPublicAccessConfiguration } from "./public-access/sim-cfn-s3-bucket-public-access-configuration.js";
@@ -7,7 +8,7 @@ import { SimCfnS3BucketWebsiteConfiguration } from "./website/sim-cfn-s3-bucket-
  * The AWS::S3::Bucket properties that are read straight off the Resource and
  * handed to a command.
  *
- * Five properties with one shape between them. Each is read from the Resource,
+ * Six properties with one shape between them. Each is read from the Resource,
  * left alone where the Resource omitted it, and otherwise applied through the
  * command an SDK caller would reach, so a template and an SDK caller are
  * validated identically. The event notification configuration is the one that
@@ -31,28 +32,27 @@ export class SimCfnS3BucketDeclaredConfigurations {
      * Apply the website configuration the Resource declares.
      */
     async applyWebsite() {
-        const WebsiteConfiguration = this.read(SimCfnS3BucketWebsiteConfiguration);
-        if (WebsiteConfiguration !== undefined) {
+        await this.applyDeclared(SimCfnS3BucketWebsiteConfiguration, async (WebsiteConfiguration) => {
             await this.simS3.putBucketWebsite({ input: { Bucket: this.bucketName, WebsiteConfiguration } }, this.options);
-        }
+        });
     }
     /**
      * Apply the Block Public Access settings the Resource declares.
      */
     async applyPublicAccess() {
-        const PublicAccessBlockConfiguration = this.read(SimCfnS3BucketPublicAccessConfiguration);
-        if (PublicAccessBlockConfiguration !== undefined) {
-            await this.simS3.putPublicAccessBlock({ input: { Bucket: this.bucketName, PublicAccessBlockConfiguration } }, this.options);
-        }
+        await this.applyDeclared(SimCfnS3BucketPublicAccessConfiguration, async (PublicAccessBlockConfiguration) => {
+            await this.simS3.putPublicAccessBlock({
+                input: { Bucket: this.bucketName, PublicAccessBlockConfiguration },
+            }, this.options);
+        });
     }
     /**
      * Apply the versioning configuration the Resource declares.
      */
     async applyVersioning() {
-        const VersioningConfiguration = this.read(SimCfnS3BucketVersioningConfiguration);
-        if (VersioningConfiguration !== undefined) {
+        await this.applyDeclared(SimCfnS3BucketVersioningConfiguration, async (VersioningConfiguration) => {
             await this.simS3.putBucketVersioning({ input: { Bucket: this.bucketName, VersioningConfiguration } }, this.options);
-        }
+        });
     }
     /**
      * Apply the Object Lock configuration the Resource declares.
@@ -63,18 +63,43 @@ export class SimCfnS3BucketDeclaredConfigurations {
      * the words an SDK caller is refused in.
      */
     async applyObjectLock() {
-        const ObjectLockConfiguration = this.read(SimCfnS3BucketObjectLockConfiguration);
-        if (ObjectLockConfiguration !== undefined) {
+        await this.applyDeclared(SimCfnS3BucketObjectLockConfiguration, async (ObjectLockConfiguration) => {
             await this.simS3.putObjectLockConfiguration({ input: { Bucket: this.bucketName, ObjectLockConfiguration } }, this.options);
-        }
+        });
     }
     /**
      * Apply the lifecycle rules the Resource declares.
      */
     async applyLifecycle() {
-        const LifecycleConfiguration = this.read(SimCfnS3BucketLifecycleConfiguration);
-        if (LifecycleConfiguration !== undefined) {
+        await this.applyDeclared(SimCfnS3BucketLifecycleConfiguration, async (LifecycleConfiguration) => {
             await this.simS3.putBucketLifecycleConfiguration({ input: { Bucket: this.bucketName, LifecycleConfiguration } }, this.options);
+        });
+    }
+    /**
+     * Apply the default encryption the Resource declares.
+     */
+    async applyEncryption() {
+        await this.applyDeclared(SimCfnS3BucketEncryption, async (ServerSideEncryptionConfiguration) => {
+            await this.simS3.putBucketEncryption({
+                input: {
+                    Bucket: this.bucketName,
+                    ServerSideEncryptionConfiguration,
+                },
+            }, this.options);
+        });
+    }
+    /**
+     * Apply one declared property, or leave the Bucket alone where the Resource
+     * omitted it.
+     *
+     * The one absence check for all six of them lives here. Each property is
+     * otherwise the same shape: read it off the Resource, and hand it to the
+     * command an SDK caller would reach.
+     */
+    async applyDeclared(Reader, apply) {
+        const declared = this.read(Reader);
+        if (declared !== undefined) {
+            await apply(declared);
         }
     }
     /**

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-property-names.d.ts

@@ -5,11 +5,9 @@ export declare const simulatedPropertyNames: ReadonlySet<string>;
 /**
  * Real AWS::S3::Bucket properties this simulation reads and does nothing with.
  *
- * Nothing this simulator models can tell the difference. There is no simulated
- * KMS and Object bytes are stored as they arrive, so an encrypted Bucket and an
- * unencrypted one answer every simulated command identically, and no simulated
- * service reads a Bucket tag. So these are not recorded as ignored either: a
- * report of differences that make no difference is one nobody can read.
+ * Nothing this simulator models can tell the difference. No simulated service
+ * reads a Bucket tag, so this is not recorded as ignored either: a report of
+ * differences that make no difference is one nobody can read.
  */
 export declare const inertPropertyNames: ReadonlySet<string>;
 import type { SimCfnSkippedPropertyRules } from "../../../cloudformation/resource/ignore/sim-cfn-skipped-property.type.js";

package/dist/service/s3/cfn/bucket/sim-cfn-s3-bucket-property-names.js

@@ -2,6 +2,7 @@
  * The AWS::S3::Bucket properties this simulation acts on.
  */
 export const simulatedPropertyNames = new Set([
+    "BucketEncryption",
     "BucketName",
     "LifecycleConfiguration",
     "ObjectLockConfiguration",
@@ -14,16 +15,11 @@ export const simulatedPropertyNames = new Set([
 /**
  * Real AWS::S3::Bucket properties this simulation reads and does nothing with.
  *
- * Nothing this simulator models can tell the difference. There is no simulated
- * KMS and Object bytes are stored as they arrive, so an encrypted Bucket and an
- * unencrypted one answer every simulated command identically, and no simulated
- * service reads a Bucket tag. So these are not recorded as ignored either: a
- * report of differences that make no difference is one nobody can read.
+ * Nothing this simulator models can tell the difference. No simulated service
+ * reads a Bucket tag, so this is not recorded as ignored either: a report of
+ * differences that make no difference is one nobody can read.
  */
-export const inertPropertyNames = new Set([
-    "BucketEncryption",
-    "Tags",
-]);
+export const inertPropertyNames = new Set(["Tags"]);
 import { validateSimCfnS3BucketReplication } from "./replication/sim-cfn-s3-bucket-replication-rules.js";
 /**
  * Real AWS::S3::Bucket properties this simulation does not model, with what
@@ -55,7 +51,8 @@ export const unsimulatedPropertyReasons = new Map([
     ],
     [
         "IntelligentTieringConfigurations",
-        "storage classes are not simulated, so nothing transitions between them",
+        "Objects are not moved between storage classes by access pattern, and " +
+            "only a lifecycle rule transitions one",
     ],
     ["InventoryConfigurations", "Bucket inventory reports are not simulated"],
     ["LoggingConfiguration", "server access logging is not simulated"],

package/dist/service/s3/command/authorize/sim-s3-authorize-action.d.ts

@@ -1,3 +1,4 @@
+import type { SimAwsResolvedCaller } from "../../../aws/caller/sim-aws-caller-resolver.js";
 import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
 import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
 import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
@@ -20,5 +21,9 @@ export interface SimS3AuthorizedAction {
  * supplied as the condition keys a Bucket policy is usually written against.
  * An omitted caller is passed through to sim IAM, so Account root fallback
  * stays owned by IAM.
+ *
+ * The resolved caller is answered rather than discarded, because this is the
+ * only point in a request where the principal has been worked out, and an
+ * Object event notification has to say who caused it.
  */
-export declare function simS3AuthorizeAction(request: SimS3AuthorizedAction): void;
+export declare function simS3AuthorizeAction(request: SimS3AuthorizedAction): SimAwsResolvedCaller;